CVE-2026-72111

A flaw was found in the Linux kernel's BPF verifier. When processing a context load of an LSM hook return value, the __mark_reg_s32_range() function incorrectly intersects new register bounds with stale ones, rather than replacing them. This can lead to a mismatch between the verifier's understanding of register values and the actual runtime values. An attacker could potentially leverage this verifier/runtime mismatch to bypass BPF memory safety checks.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because triggering the flaw requires local access and elevated privileges to load BPF programs hooked into Linux Security Modules, limiting the attack surface. While a privileged local user could potentially cause an inconsistency between static verification and runtime execution to circumvent internal kernel memory safety constraints, exploitation cannot be initiated remotely. Additionally, older platforms such as Red Hat Enterprise Linux 8 are not vulnerable because the underlying register-narrowing mechanism was introduced in later upstream kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.